This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-123158 →
Unrated
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misint...
ALPINE-CVE-2026-123158
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Alpine:v3.16 | openssh |
< 9.0_p1-r6 |
9.0_p1-r6 |
| Alpine:v3.17 | openssh |
< 9.1_p1-r7 |
9.1_p1-r7 |
| Alpine:v3.18 | openssh |
< 9.3_p2-r4 |
9.3_p2-r4 |
| Alpine:v3.19 | openssh |
< 9.6_p1-r3 |
9.6_p1-r3 |
| Alpine:v3.20 | openssh |
< 9.7_p1-r6 |
9.7_p1-r6 |
| Alpine:v3.21 | openssh |
< 9.9_p2-r1 |
9.9_p2-r1 |
| Alpine:v3.22 | openssh |
< 10.0_p1-r11 |
10.0_p1-r11 |
| Alpine:v3.23 | openssh |
< 10.2_p1-r1 |
10.2_p1-r1 |
| Alpine:v3.24 | openssh |
< 10.3_p1-r2 |
10.3_p1-r2 |
Original description The description as published by the source.
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- advisory security.alpinelinux.org